IN THE CLAIMS 

Please amend the claims to read as follows: 
Listing of Claims: 

1 . (Currently Amended) A network monitoring system that monitors ^communication 
within a network including a plurality of terminals, the terminals including between at least a 
client and a_server, the terminals communicating a plurality of action contents with each other, 
each action content consisting of a grou p of associa ted packets, the network monitoring system 
comprising: 

a data acquisition section that acquires a plurality of packets flown on a network; 

a data analysis section that analyses each of the packets to extract the group of associated 
packets from, all the packets and t hat acquires anaction explanation information content from the 
plurality group of associated packets acquired by th e data acquisition section , the data analysis 
section extracting a plurali ty of groups of the associated packets and acquiring a plurality of 
action contents therefrom ; 

a display-information generation section that generates a display information by 
chronologically aligning the plurality of action contents to correspond to respective times when 
the action contents are actually commuincated ef-e ach in di vidual action occurring <m the network 
en the basis of the action explanation infonna tien- acquired by the data-analysis section ; and 

a display unit that displays an association chart indicating the t erminals wthin the 
network and that sup erimposes additional objects on the association chart, the addit ional objects 
bein g generated in accordance with the display informati o n ■ generated by -tfa e display information 
generation-s ection, wherein: , the additional objects being superimposed on the association chart 
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in a chronol o g ical order along with a real-time sequence of communication of the action 
contents, 

in response to a request by a user, the display - info r mation generation- s ee - t i on regenerates, 
for continuous play back, infefmQtien--ef"a-se q «enee- & f - iadiv i dua l actions that occurred on the 

network and cooperates with the display unit to disp l ay, during each play back, the regen erated 

inforffiation - ef e aeh in div i dual a ctien- of the sequence at th e same time in terv al within-the 
seqttene e as the action occurred, 

action explanation information for explaining each individual - action is acquired - - frem -a 
plurality of packets, and 

wherein the information displayed by the display unit additional objects includes 
the type of operating system employed by the client, 
the type of operating system employed by the server, 
an account name of a user accessing the client, and 
an icon representing the account name. 

2. (Currently Amended) The network monitoring system according to claim 1 , wherein 
the action content explanation information is defined in advance. 

3. (Currently Amended) The network monitoring system according to claim 1 , wherein 
the data analysis section identifies kinds of the packets acquired by the data acquisition section 
and acquires the action cuniciuexplattatioft -information from the packets on the basis of the 
identified kinds of the packets. 
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4. (Currently Amended) The network monitoring system according to claim 1 , wherein 



sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

5. (Currently Amended) The network monitoring system according to claim 1 , further 
comprising: 

an analysis data storage section that stores the action con ten t ex p 1 a n at i on in form a ti en 
acquired by the data analysis section, wherein: 

the display-information generation section regenerates the information of the sequence of 
individual actions that occurred on the network from the action content expl anation - in formation 
stored by the analysis data storage section. 

6. (Currently Amended) The network monitoring system according to claim 5, wherein: 
the action content explanation information stored by the analysis data storage section 

includes time information, which corresponds to the time at which the single action occurred; 
and 
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the display- in formati on generation section determines the time interval, within the 
sequence, that each individual action occurred using the time information stored by the analysis 
data storage section. 

7. (Previously Presented) The network monitoring system according to claim 5, wherein 
the display-information generation section continuously regenerates the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

8. (Previously Presented) The network monitoring system according to claim 1, wherein 
the display-information generation section extracts and generates the information of each action 
occurring on the network in accordance with a display setting set by a user, 

9. (Currently Amended) A network monitoring method for monitoring ^communication 
within a network including a plurality of terminals, the terminals including between at least a 
client and ^server, the terminals communicating a plurality of action contents with each other, 
each action content consisting of a group of associated packets, the method comprising: 

acquiring a plurality of packets flown on a network; 

analy zing ea ch of the packets to extract the grou p of associated packets from all the 
packets and acquiring anaction content expknat ie n- in feHBation from the plurality group of 
associated aequired packets , and extracting a plurality of groups of the associated packets and 
acquiring a pluralit y of action contents therefrom ; 

generating display information by chronologically aligning the plurality o f action 
contents to correspond to respective times when the action content - ire t.jul h lOmmunicated ef 
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each individual action occurring on the network on the basis ofH^e-aeqatfed-aotion-ex^aaatiea 
information ; 

Fege n e r a tiHg 4^- eon - tinueu s - piay - back, in r c spo f i s e to - a - req u e s t by a user, info r mation of a 
sequence ofindividuai actions thai occurred en the network; a n d 

displaying on a display un it^-duri ng each pl ay-bae k, the regenerated information of each 
i ndividual action of the sequence at the s ame time interval within the sequence as- the action 
e@eH . ff e 4 rW . k eFg j . rH 

action explanation information for explain i ng each indiv i dual action i s-aequifed from a 

plurality of packets, and 

wherein the i nfo rm at i on displayed on the display unit additional objects includes 

the type of operating system employed by the client, 

the type of operating system employed by the server, 

an account name of a user accessing the client, and 

an icon representing the account name. 

10. (Currently Amended) The network monitoring method according to claim 9, wherein 
the action content expte nat ion i nf ormation is defined in advance. 

1 1 . (Currently Amended) The network monitoring method according to ciaim 9, wherein 
in the acquisition of the action content- e xplanation i ftfomaifoft, kinds of the packets acquired by 
the packet acquisition are identified and the action content explanation informat ion is acquired 
from the packets on the basis of the identified kinds of the packets. 
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12. (Currently Amended) The network monitoring method according to claim 9, wherein 
the action content expianation information includes: 

sending source computer information and destination computer information included In a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

1 3. (Currently Amended) The network monitoring method according to claim 9, further 
comprising: 

storing the acquired action content expianation information , wherein: 
the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action content expianation information . 

14. (Currently Amended) The network monitoring method according to claim 3 3, 
wherein: 

the stored action content expianation information includes time information, which 
corresponds to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 
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15. (Previously Presented) The network monitoring method according to claim 13, 
further comprising continuously regenerating the sequence after each predetermined period, 
which period is accurate within 500 milliseconds. 

16. (Previously Presented) The network monitoring method according to claim 9, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 

1 7. (Currently Amended) A network monitoring program recorded on a computer 
readable medium and executable by a computer, the program making the computer monitor a 
communication within a nctu trk tt Judin g a plurality of terminals, the terminals 
including between at least a client and a server , the terminals communicating a plurality of action 
contents with each other, each action content consisting of a group of associated packets, and 
perform a process comprising: 

acquiring a plurality of packets flown on a network; 

analyzing each of the packets to extract the group of associated packets from all the 
packets and acquiring an action content explanation information from the plurality group of 
associated acquircd packets , and extracting a plurality of groups of the associated packets and 
ac quirin g a pluralit y of action contents therefrom ; 

generating display information by chronoloi - lily a g nmg the plurality of action 
content s to correspond to respective times when the action contents are actually communicated ef 
^h - individua Ta^tion-ee eurring on the network on the basis of^e-aequired actioii- exp l anat iea 
i n f ormatio n; 
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regenora t m ' g-gar-eefiti - nueu - g-ptey-b a ek; ifl^e sp efise^e-a-rectaest-by-a-H 'Sg r, information of a 

dtsplayiag -eH-a-4 isplay unit, durifi - g -e ae - h play back, the regenerated information of each 
individual action of the s equence at the s ame time interval within the sequence as tho actio s 
occurred, wherein: 

action explanation information for explaining each individual action is aoquireu from-a 
pluraiity H#^a^et%-aftd 

wherein the infonnation displayed -on the- di sp lay uni t additional objects includes 

the type of operating system employed by the client, 

the type of operating system employed by the server, 

an account name of a user accessing the client, and 

an icon representing the account name. 

18. (Original) The network monitoring program according to claim 17, wherein the 
action content explanation information is defined in advance. 

19. (Currently Amended) The network monitoring program according to claim 17, 
wherein in the acquisition of the action content explanation-inf o rmation , kinds of the packets 
acquired by the packet acquisition are identified and the action content ex^tefiafaeH4fifi&HBatieB is 
acquired from the packets on the basis of the identified kinds of the packets. 

20. (Currently Amended) The network monitoring program according to claim 17, 
wherein the action content explanation informatio n- includes: 
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sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet: and 

data included in a data packet. 

21. (Currently Amended) The network monitoring program according to claim 1 7, 
wherein: 

the process further comprises storing the acquired action content explanution information : 

and 

the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action content explanation information . 

22. (Currently Amended) The network monitoring program according to claim 2 1 , 
wherein: 

the stored action conten t explanat ion in form at km includes time information, which 

corresponds to the time at which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 



10 



23. (Previously Presented) The network monitoring program according to claim 21, 
wherein the process further comprises continuously regenerating the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

24. (Previously Presented) The network monitoring program according to claim 1 7, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 

25. (Previously Presented) The network monitoring system of claim 1, wherein the 
display unit displays a graphical representation of the communication connection between the 
client and the server. 

26. (Previously Presented) The network monitoring method of claim 9, wherein the 
display unit displays a graphical representation of the communication connection between the 
client and the server. 

27. (Previously Presented) The network monitoring program of claim 17, wherein the 
display unit displays a graphical representation of the communication connection between the 
client and the server. 
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